Security audit
Security checks for vulnerabilities and agentic risk
This Shopee category lookup skill is mostly coherent, but it tells the agent to install tooling and configure credentials on the host, which is broader authority than a narrow lookup skill needs.
Install only if you are comfortable letting the agent install or update qhkit/Node tooling and configure a Qinghu API token on your machine. Prefer a preinstalled, pinned qhkit version and provide credentials through a scoped, revocable token rather than letting the skill write long-lived credentials without review.
The manifest says the skill '必须触发' when users say phrases including '查二级类目 ID' or make '同类需求', which are ambiguous and can overlap with many ordinary category-ID lookup requests. It does not provide exclusion conditions or clear limits for when this skill should not activate versus related Shopee category skills.
The activation examples include '××一级类目下有哪些二级类目' and '查二级类目 ID', but the latter is broad and the section does not explain what similar phrasings are in-scope or out-of-scope. Without exclusions, the skill may be invoked for generic category-ID requests unrelated to Shopee level-2 lookup.
The skill goes far beyond data lookup and directs the agent to install Node.js and globally install the qhkit CLI, modifying the host environment. For a category-query skill, these are unnecessary privileged setup actions that expand attack surface, enable supply-chain compromise, and violate least-privilege expectations.
The skill instructs use of npx @iqinghu/qhkit without pinning a specific version or integrity-verified artifact. That can cause execution of an unexpected or newly published package version, increasing supply-chain risk in a skill that is supposed to perform a narrow category query.
This duplicated finding points to the same persistence behavior: unpacking software into the user home directory and exporting a modified PATH. Even with checksum verification, the action exceeds the skill’s stated purpose and creates lasting environmental state that can be abused or can unexpectedly influence future tool execution.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
This duplicated finding points to the same persistence behavior: unpacking software into the user home directory and exporting a modified PATH. Even with checksum verification, the action exceeds the skill’s stated purpose and creates lasting environmental state that can be abused or can unexpectedly influence future tool execution.
cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"
The skill instructs persistent credential configuration via qhkit config set and environment variables, which writes secrets into the host/session environment for a simple query workflow. This broadens secret exposure and can leak credentials to later processes, other tools, or future sessions unrelated to the user’s immediate request.
The sample command hard-codes 'language':'zh-CN', which can steer use toward a specific locale. Although the file later lists multiple supported languages, this example presents a default forced locale without an explicit instruction to ask the user or respect their preference.
No suspicious patterns detected.